Research map / Adversarial robustness and security / Attacks on text and graphs
Physical adversarial patches and camouflage
Design and defend against printable patches and 3D camouflage fooling detectors.
56 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Attacks on text and graphs, keyword cluster “physical · object · patches”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
20 papers in 2023–24 and 21 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 7.2% to 4.3%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Adversarial camera stickers: A physical camera-based attack on deep learning systems (ICML 2019 · 90 citations)
- 2020 · Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles (CVPR 2020 · 229 citations)
- 2021 · Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect (CVPR 2021 · 57 citations)
- 2022 · Shadows Can Be Dangerous: Stealthy and Effective Physical-World Adversarial Attack by Natural Phenomenon (CVPR 2022 · 154 citations)
- 2023 · Physically Adversarial Infrared Patches With Learnable Shapes and Locations (CVPR 2023 · 49 citations)
- 2024 · Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving (CVPR 2024 · 54 citations)
- 2025 · Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · 5 citations)
- 2026 · Unleashing the Representational Power of Fourier Shapes for Attacking Infrared Object Detection (ICML 2026 · 0 citations)
Earliest papers here
- Adversarial camera stickers: A physical camera-based attack on deep learning systems (ICML 2019 · 90 citations)
- Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles (CVPR 2020 · 229 citations)
- Universal Physical Camouflage Attacks on Object Detectors (CVPR 2020 · 188 citations)
What has been tried
45 papers here report 456 measured changes (a component added, removed or swapped, compared with a baseline): helped 69%, no clear effect 5%, hurt 22%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add texture conversion | Monodepth2, vehicle · Ed | 8.15 -> 12.75 | Helped | Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving (CVPR 2024 · 54 citations) |
| Use the full PAD pipeline rather than semantic-independence localization alone | INRIA Person test, OBJ, P3, P4, P5 · mAP (%) | 86.3 vs 78.6; 78.7 vs 76.3; 85.4 vs 77.4; 81.5 vs 74.0 | Helped | PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · 44 citations) |
| Add rigid and non-rigid clothing transformations during DAP evaluation | INRIA · mAP | 6.54% -> 15.44% | Hurt | DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · 32 citations) |
| Set object trigger size λ to 0.1 instead of 0.2 | ScanRefer · Acc@0.25 | 15.05 -> 18.34 | Hurt | Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · 5 citations) |
| Add the 3D control points-based mesh smoothing algorithm | Adversarial meshes and patterns · Smoothness | Helped | Infrared Adversarial Car Stickers (CVPR 2024 · 5 citations) | |
| Use a 10×10 grid instead of a 60×60 grid | Digital test, confidence threshold 0.25 · SeqASR | 8.0% -> 63.1% | Helped | Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · 4 citations) |
| Replace RGB or YCbCr input with grayscale images | COCO, Patch-4 training, silent · accuracy | 74.11 -> 92.95; 78.44 -> 92.95 | Helped | A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · 4 citations) |
| Add the camera ISP proxy network | Physical world, ArcFace · ASR | 56% -> 68% | Helped | ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector (CVPR 2025 · 4 citations) |
| Add the camera ISP module to the patch-generation pipeline | Physical space, six cameras · ASR (%) | without camera ISP: 55, 70, 60, 75, 85, 75; full method: 95, 95, 100, 90, 100, 95 | Mixed | Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · 2 citations) |
| Increase the adversarial-feature clipping threshold | Prompt yellow black graffiti · AP@0.5 | 0.606, 0.449, 0.479, 0.481, 0.520 | Mixed | CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors (NeurIPS 2024 · 2 citations) |
| increase the number of circles from 1 to 3 | Digital-world misrecognition attack · ASR | 88.42% -> 96.41% | Helped | The Fluorescent Veil: A Stealthy and Effective Physical Adversarial Patch Against Traffic Sign Recognition (NeurIPS 2025 · 1 citation) |
| add W(x_ref) loss weighting during NRP training | Vehicle-region rendering at distances 5, 10, 15, and 20 · MAE | 7.22 -> 6.50; 6.91 -> 5.51; 7.14 -> 5.53; 6.76 -> 5.23 | Helped | RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation (ICML 2024 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 10 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- COCO · 4 of 10 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 41 papers; from OpenAlex and the papers' affiliations).
- The University of Tokyo · 4 papers
- Tsinghua University · 4 papers
- Harbin Institute of Technology · 3 papers
- Wuhan University · 2 papers
- Zhejiang University · 2 papers
- University of California, Riverside · 2 papers
- Queen’s University Belfast · 2 papers
- Harbin Institute of Technology Shenzhen · 2 papers
- Nankai University · 2 papers
- National University of Singapore · 2 papers
Use it
Download BibTeX of 37 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Latency and driving-perception attacks (25 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).